Arch Linux User Repository

One solution would be to make the config not readable by non-root users and load it using LoadCredentials in the systemd service.

@Poscat In fact, most users who care about this should create a configuration file under /etc/sing-box/ themselves, set the permissions, and then enable sing-box@[config_file_name].service.

However, can you send me a patch to my email? I will carry out a review.

One solution would be to make the config not readable by non-root users and load it using LoadCredentials in the systemd service.

Are there any reasons the default config is readable by anyone? This seems to be a potential security issue :/

@Poscat Since the sing-box user is created by systemd-sysusers, modifying the file group to sing-box within the PKGBUILD should not work. I'm not sure what the best practice is for this type of requirement. Do you have any related suggestions?

Are there any reasons the default config is readable by anyone? This seems to be a potential security issue :/

add gopath to build so that it doesn't pollute your home dir export GOPATH="$SRCDEST/go-modules"

@kevku Setting GOPATH="$SRCDEST/go-modules can be a helpful solution if they haven't already configured a GOPATH, I will submit an update soon.

add gopath to build so that it doesn't pollute your home dir

export GOPATH="$SRCDEST/go-modules"

When using tun inbound with systemd-resolved, sing-box would execute resolvectl commands to modify default DNS route and search domain, but sing-box user does not have this privilege.

ref: https://github.com/SagerNet/sing-box/issues/477 https://github.com/SagerNet/sing-tun/blob/38c945fec5df642b1ee0895c5c3a75a3f1276341/tun_linux.go#L821-L824

I suggest install a polkit rule file to /usr/share/polkit-1/rules.d/sing-box-tun.rules:

// Allow sing-box to set domain and default-route
polkit.addRule(function(action, subject) {
    if ((action.id == "org.freedesktop.resolve1.set-domains" ||
         action.id == "org.freedesktop.resolve1.set-default-route" ||
         action.id == "org.freedesktop.resolve1.set-dns-servers") &&
        subject.user == "sing-box") {
        return polkit.Result.YES;
    }
});

This would allow sing-box user to modify systemd-resolved DNS configuration without manual authorization.

sing-box 的默认构建标记已经包含 with_dhcp，请求添加。

能否为ech添加支持 ECH is not included in this build, rebuild with -tags with_ech